Overview
PwC (PricewaterhouseCoopers) is one of the Big Four professional services networks, formed in 1998 through the merger of Price Waterhouse and Coopers & Lybrand. The network reported US$55.4 billion in aggregate revenue for FY2024 across approximately 370,000 employees in 152 countries. PwC operates as a network of member firms; Mohamed Kande serves as PwC Global Network Chair from July 2024. Cyber and identity sit within the Risk Services line of business, with significant cyber revenue concentrated in PwC US, PwC UK, PwC Germany, and PwC Australia.
Within identity and security consulting, PwC fields a substantial Big Four practice covering identity strategy, IGA implementation on SailPoint and Saviynt, PAM on CyberArk and BeyondTrust, customer identity, and managed identity operations. The firm holds top-tier alliance status with SailPoint, Microsoft, Okta, Saviynt, and CyberArk. Cyber and identity work is heavily anchored in financial services, where PwC's audit dominance in banking and capital markets drives demand for SOX, DORA, and operational resilience programmes that include identity controls. PwC also runs a meaningful incident response and threat intelligence practice through PwC Cyber Security.
PwC is typically a fit for regulated enterprises and global financial services buyers that want identity work bundled with risk, regulatory compliance, and operational resilience programmes. The firm is rarely the cheapest option and faces the same audit-conflict constraints as other Big Four members in the US market. Smaller single-platform IGA deployments under US$1 million are usually better served by Optiv, SailPoint Professional Services, or another specialist.
Services Offered
- Identity strategy, IAM operating model, and roadmap
- SailPoint and Saviynt IGA implementation and migration
- CyberArk and BeyondTrust privileged access deployments
- Microsoft Entra ID, Entra ID Governance, and conditional access design
- Customer identity (CIAM) on Okta and Ping
- Zero-trust architecture and operational resilience programmes
- SOX, DORA, NIS2, and ISO 27001 access controls advisory
- Incident response, breach investigation, and forensics
- Managed identity services and access certification operations
- Privacy programme, GDPR, and data classification advisory
Typical Engagement
| Engagement Type | Model | Typical Range |
|---|---|---|
| IAM strategy and target state design | Fixed-fee project | $250K–$1M (6–12 weeks) |
| IGA or PAM implementation | Fixed-fee or T&M | $1.8M–$9M (8–18 months) |
| Enterprise identity transformation | Multi-year outcome contract | $10M–$40M+ (24–42 months) |
| Managed identity services | Monthly retainer | $70K–$800K per month |
| Staff augmentation (Certified IAM) | Hourly bill rate | $175–$330/hour blended |
Pricing ranges verified May 2026 from public procurement records, identity vendor channel benchmarks, and reference checks. PwC Acceleration Centres in India and Poland lower blended rates by 20–35%.
Strengths
- Deep cyber and identity bench in financial services, anchored by leading global banking audit relationships
- Strong regulatory and resilience advisory for SOX, DORA, NIS2, MAS, APRA, and PRA requirements
- Top-tier alliance status with SailPoint, Microsoft Entra, Okta, Saviynt, and CyberArk
- Acceleration Centres in India and Poland deliver competitive blended rates for IGA platform work
- Integrated delivery combining identity with internal audit, controls testing, and regulatory reporting
- Mature global cyber crisis response capability supporting incident-driven IAM remediation
Limitations
- Premium pricing — partner and director rates frequently exceed US$400/hour onshore
- Audit-client independence rules restrict the addressable buyer base in the US for non-audit clients only
- Methodology-heavy delivery can slow product-led IGA work compared with specialist firms
- Identity bench is smaller than Deloitte's, particularly outside financial services
- Recent partnership restructuring in PwC US and UK has driven senior consultant churn during multi-year programmes